nostr: never advertise a rendezvous we are not registered at (#26)

BtfActiveRelay() fell back to vBtfMeetingRelays[0] whenever registration had
not completed yet. ThreadNostrSeed and ThreadBtfAccept start in parallel
(net.cpp), so at boot that fallback was exactly what PublishDescriptor wrote
into the descriptor -- including the one-time self-test, which publishes to
every relay in the list. Peers reading it dialed a rendezvous this node was
never registered at, and whenever the first seed happened to be down
(92.246.128.180 was, for part of today) every one of those dials was wasted.

BtfActiveRelay() now returns only the relay ThreadBtfAccept confirmed, and
PublishDescriptor skips publishing until there is one. The seed loop
republishes on every pass, so the only cost is the delay until registration
succeeds; the self-test waits up to 60s for it so it still measures the
publish/resolve chain instead of losing the race against it.

Also fix the WebSocket handshake reader. On headers past the cap it did a
bare break, leaving the socket parked in the middle of the header block --
and since the status line had already been read, the " 101 " check still
passed, so the caller got a "connected" socket whose next bytes were
leftover HTTP that the frame parser then read as garbage frames. It now
errors out instead, and the cap is 8192 because relays behind Cloudflare
send large header blocks.

2 files changed, 32 insertions, 7 deletions

diff --git a/src/nostr.cpp b/src/nostr.cpp
index 6f3b6a7..ec02c2e 100644
--- a/src/nostr.cpp
+++ b/src/nostr.cpp
@@ -100,13 +100,17 @@ vector<string> vBtfMeetingRelays = {
 string strBtfActiveRelay;
 static CCriticalSection cs_activeRelay;
 
+// Only the rendezvous we actually registered at (BtfSetActiveRelay, called from
+// ThreadBtfAccept once registration succeeds). Empty until then, on purpose: it
+// used to fall back to vBtfMeetingRelays[0], and since ThreadNostrSeed and
+// ThreadBtfAccept start in parallel (net.cpp), that fallback is what got
+// published at boot -- a descriptor telling peers to dial a relay we were not
+// registered at. When that first seed was down, every peer that read the
+// descriptor burned a dial on a dead rendezvous.
 string BtfActiveRelay()
 {
     CRITICAL_BLOCK(cs_activeRelay)
-        if (!strBtfActiveRelay.empty())
-            return strBtfActiveRelay;
-    if (!vBtfMeetingRelays.empty())
-        return vBtfMeetingRelays[0];
+        return strBtfActiveRelay;
     return "";
 }
 
@@ -542,7 +546,13 @@ public:
             int n = RawRead(&c, 1);
             if (n <= 0) return error("Nostr: no handshake response from %s", host.c_str());
             resp += c;
-            if (resp.size() > 4096) break;
+            // Bail out instead of breaking: breaking left the socket parked in
+            // the middle of the header block, and since the status line is read
+            // first the " 101 " check below still passed -- so the caller got a
+            // "connected" socket whose next bytes were leftover HTTP, which the
+            // frame parser then read as garbage frames.
+            if (resp.size() > 8192)
+                return error("Nostr: handshake headers too large from %s", host.c_str());
         }
         if (resp.find(" 101 ") == string::npos)
             return error("Nostr: handshake refused by %s", host.c_str());
@@ -749,7 +759,14 @@ static void PublishDescriptor(CWebSocket& ws, CNostrKey& key)
     // (ThreadBtfAccept in net.cpp) is registered at -- where clients dial us.
     string meeting_node = BtfActiveRelay();
     if (meeting_node.empty())
-        meeting_node = "rendezvous-pending";
+    {
+        // Not registered anywhere yet. Publishing now would advertise a meeting
+        // node we can't be reached at, and peers would waste dials on it. The
+        // ThreadNostrSeed loop republishes on every pass, so skipping costs
+        // nothing but the delay until ThreadBtfAccept registers.
+        LogPrint("nostr", "Nostr: skipping descriptor publish, no rendezvous registered yet\n");
+        return;
+    }
     string desc = btf::SignDescriptor(key.ctx, key.seckey, key.EncPubHex(),
                                       meeting_node, (uint64_t)GetTime());
     if (desc.empty())
@@ -1564,6 +1581,13 @@ void ThreadNostrSeed(void* parg)
     LogPrint("nostr", "Nostr: node pubkey = %s\n", key.PubKeyHex().c_str());
     LogPrint("nostr", "Nostr: node .btf address = %s\n", key.BtfAddress().c_str());
 
+    // The self-test below publishes a real descriptor, and PublishDescriptor now
+    // refuses to publish before ThreadBtfAccept has registered a rendezvous. Give
+    // registration a bounded head start so the test measures the publish/resolve
+    // chain instead of losing the race against it.
+    for (int i = 0; i < 60 && !fShutdown && BtfActiveRelay().empty(); i++)
+        Sleep(1000);
+
     // One-time self-test of the rendezvous: publish our descriptor to a relay,
     // then resolve our OWN .btf address back and verify it self-certifies. Proves
     // the .btf publish/resolve/verify chain works against real public relays.
diff --git a/src/nostr.h b/src/nostr.h
index 37b3b05..04149e3 100644
--- a/src/nostr.h
+++ b/src/nostr.h
@@ -34,7 +34,8 @@ extern const int nNostrRelays;
 extern std::vector<std::string> vBtfMeetingRelays;
 // The relay this node is currently registered at (set by ThreadBtfAccept).
 extern std::string strBtfActiveRelay;
-// The active relay, or the first seed if none active yet ("" if the list is empty).
+// The relay we are registered at, or "" if registration hasn't succeeded yet.
+// Never guesses a seed: an unregistered node has no meeting node to advertise.
 std::string BtfActiveRelay();
 // Record the relay this node just registered its service at (thread-safe).
 void BtfSetActiveRelay(const std::string& relay);